Cyber Essentials certification, certified in under 6 hours.

Cyber Essentials is a UK government-backed certification scheme that validates five technical cyber controls: firewalls, secure configuration, user access control, malware protection, and security update management. It is administered by IASME on behalf of the NCSC.

Cyber Essentials Plus adds an independent technical audit - external vulnerability scan, device configuration check, MFA verification - on top of the CE self-assessment. Plus is required by many UK government contracts and most large enterprise supply chains.

UK Cyber Essentials fees are set by each IASME-licensed Certification Body within the IASME-published headcount tiers (Micro 1-9, Small 10-49, Medium 50-249, Large 250+). Fig Group prices Cyber Essentials from £299.99 + VAT for Micro, rising to £399.99 (Small), £449.99 (Medium), and £549.99 (Large), with all tiers set below the standard IASME certification body fee.

Fig publishes a 6-hour turnaround guarantee for compliant Cyber Essentials submissions made before midday on a UK business day. If the submission needs edits, the clock pauses while you fix them and resumes on re-submission.

v3.3 is the Cyber Essentials scheme version effective from 28 April 2026. It adds mandatory multi-factor authentication on every user account, clearer BYOD and cloud-service scoping, and tightens remote-worker home-router expectations.

Yes. Multi-factor authentication is mandatory on every user account that accesses organisational data on or after 28 April 2026. This includes cloud services, email, admin accounts, remote access, and line-of-business SaaS applications.

Every device and service used to access organisational data: laptops, desktops, phones, tablets, cloud services, home routers for remote workers (under v3.3), and corporate network equipment. Anything that does not access organisational data is not in scope.

Twelve months from the assessment date. On the anniversary the certificate lapses with no grace period. Most organisations re-certify 14 days before expiry to protect contract continuity.

You are removed from the NCSC register and are no longer certified for contract purposes. Re-certification restores the listing; if you have already done the readiness work, the renewal questionnaire is typically much shorter than the initial submission.

Under PPN 014/21 it is required for central government contracts that handle sensitive or personal information. The specific requirement varies by contract; some require CE, some require CE Plus. Always check the bid documentation.

Cyber Essentials covers five technical controls. ISO 27001 is a full information security management system with 93 Annex A controls, policies, risk processes, internal audits, and a formal multi-day certification audit. For a practical buyer-focused breakdown, see /blog/cyber-essentials-vs-iso-27001-which-does-your-customer-actually-want.

Cyber Essentials is certified per organisation, not per MSP. Your MSP can manage the assessment and remediation, but your organisation signs the attestation and holds the certificate.

Three buyer contexts drive most CE certification: UK suppliers covered by PPN 014/21 government procurement; supply-chain vendors where a tier-one customer mandates CE in contract; and regulated firms (SJP partner practices, FCA-regulated firms, NHS suppliers) where certification is contractually expected. Insurers also increasingly request CE evidence at PI quote and renewal.